Someone is using my sendmail

[shiftsrl]

I've a linux server with many virtual domains and sendmail. The problem is that someone is using my sendmail to spam and this someone is using it through, (I think) an html or php form so I'm unable to track it down and discover in which virtual domain this form is stored.

Could someone help me telling me where and how to look at the logs or wherever to delete this script?

Many many thanks

 

[CGI101]

i don't know much about mail and stuff but i've been having the same issue and i've learned a few things within the past week or so..

do you have whm/cpanel installed?

if so, go under whm, Tweak Settings, mail and find where it says:

"Track the origin of messages sent though the mail server by adding the X-Source headers (exim 4.34+ required)"

put a check mark next to it.